project-tiny-context-harness 0.8.13 → 0.8.16

package/README.md

@@ -116,7 +116,7 @@ Use this route when an implementation delivery both genuinely needs new style-be
 2. If Design Authority is absent and the scope is style-bearing, explicitly select `$design-system-authoring` to generate, select and adopt the canonical `DESIGN.md`, token source and provider binding. Skip it when Design Authority is already configured.
 3. Prepare a writable project-native initial proposal at a concrete path such as `docs/initial-proposal.md`. It may come from the user, an external service or an explicitly requested applicable proposal capability; `design-resource-authoring` does not author it, and no standalone intermediary authoring stage is required.
 4. Select `$design-resource-authoring` with that path plus the exact development scope and targets. Keep its reconciled proposal, validated residual `design-resource-handoff-v1`, and selected immutable canonical resources, manifest and dependencies.
-5. Select `$long-task-workflow` with the exact paths to all of those inputs. It authors the Source-bound Contract Draft. The first Compile/Authority Lock always ends the current turn before implementation and says `After handling the model change, send [continue].`; earlier model wording cannot skip this boundary and Harness cannot observe whether the host model changed. After the user resumes, the parent evaluates delegation suitability and delegates independent bounded work only when the host explicitly selects exact `long_task_implementation`; otherwise it executes in the parent without a generic substitute. The parent still owns authority, architecture, Context, integration, current-candidate checks and formal verification.
+5. Select `$long-task-workflow` with the exact paths to all of those inputs. It authors the Source-bound Contract Draft. The first Compile/Authority Lock always ends the current turn before implementation and says `After handling the model change, reply exactly: model checkpoint cleared, continue`; a generic continuation does not satisfy the managed prompt protocol, earlier model wording cannot skip this boundary, and Harness cannot observe the next host message or whether the model changed. After the user resumes, the parent identifies qualifying bounded packets before profile/capacity. Absent an explicit user or host prohibition, a qualifying set requires actual host calls for multiple exact `long_task_implementation` workers; host results determine zero-start or partial fallback under the Skill's six-reason rule. Worker count stays dynamic, generic substitutes remain forbidden, and the parent alone owns Source, Contract, Authority, architecture, Context, packet selection, integration, current-candidate checks, formal verification, Final Gate, close and completion.
 
 ```text
 $design-system-authoring Generate, select and adopt the project design system for this style-bearing scope. Skip this request when DESIGN.md is already configured.
@@ -189,7 +189,7 @@ npm ci
 npm run smoke:quickstart
 npm run preview:pack
 cd /path/to/your/test-repo
-npm install -D /path/to/project-tiny-context-harness/tmp/ty-context/source-preview/package/project-tiny-context-harness-0.8.13.tgz
+npm install -D /path/to/project-tiny-context-harness/tmp/ty-context/source-preview/package/project-tiny-context-harness-0.8.16.tgz
 npx --no-install ty-context init --adopt
 make validate-context
 ```
@@ -298,6 +298,10 @@ The default Workflow performs UI Authority Closure and a conditional Design Auth
 
 For selected implementation handoff files, DSA first publishes the exact target set with `ty-context design-resource bundle`; both development paths rerun `ty-context design-resource preflight <handoff.md>` on every published file. Incomplete acquisition, missing or undeclared dependencies or targets, duplicate targets, unsafe paths, stale manifest/file digests, fictional locators, non-frozen or incomplete Census, sampled/truncated generation, aggregate axis values, mismatched Expected/Canonical/Handoff Fact sets, missing required methods, invalid comparator/Oracle/environment binding, unresolved design-system lineage, uncovered applicable cells, absent exact-target layout/pixel facts, unsupported evidence and unresolved meaning all fail closed. Each workflow must still open the resources and prove the production implementation on the real entry.
 
+In Long-Task projection, every Claim-bearing Assertion remains single-Claim. For each selected-design verification method, the target's root conformance Assertion and that method's independent Assertion jointly cover the Source Claims referenced by its Facts or Rules; the union closes coverage without collapsing method capabilities, evidence, results or failure attribution.
+
+Repository patterns accept parentheses only as escaped literal route-group characters—never regex groups or extglob—while preserving existing `*`, `**`, `?` and rejecting unsupported `[]`/`{}` syntax.
+
 For material work, `context_uiux_design` applies the projection above and keeps risk-proportional coverage reasoning task-local. `context_development_engineer` traces every affected selected target and declared condition through stable surface/control keys to the production route/component owner, cold-start real-user journey and applicable rendered/interactive checks. A first useful runnable production slice is a recommended real-entry feedback point when early localization is worth the cost, never an implementation gate; the final candidate always reruns the affected cold-start journey. Source-required combinations cannot be silently pruned, but default work reports conditions it did not establish instead of claiming exact machine closure. Resource hashes, manifests and counts prove integrity only; an implementation screenshot cannot become its own target or implementation-conformance proof.
 
 An explicit Long-Task is the strong authority carrier of the same shared obligation. It resolves missing/conflicting UI authority before Compile, then closes all 22 canonical fields of every real Product Control through `field_coverage`; that semantic Control projection is independent of, and never caps, the finer design Fact universe. Selected targets freeze the canonical manifest identity/digest and project every atomic Fact/required-method pair into a `fact_expectations` row with subject/target/condition/variation/property identity, expected located-value digest, comparator/parameters/tolerance/mask, Oracle identity/capabilities, environment and sensitivity. Only a package-admitted observer may supply the matching `fact_results` Actual/comparison row. In the current slice, project `design_conformance`, `design_method` and `fact_results` records are diagnostic; affected UI/design obligations remain blocking External Confirmations rather than machine proof. Product `surface_bindings`, Control Claims/relations and root-entry journeys continue to carry product semantics, while existing Claim, Assertion, Check, Stage, Binding, revision and Final Gate mechanisms remain the sole Long-Task lifecycle and closure. Every blocker preserves exact Source-item/method/capability lineage and cannot be dismissed in-band; scope removal requires revised Source/Contract authority.
@@ -346,7 +350,7 @@ The explicit Long-Task Workflow uses one currently selected platform-native exec
 
 Its proof claim is conditional: complete and accurate Source at the declared observable granularity, meaning-preserving projection and complete applicability expansion make `AcceptedDeliveryTerminal`—exactly a fresh `machine_accepted` result with no pending External Confirmation—imply that no declared machine-observable drift remains only when every machine obligation has frozen Expected authority, package-admitted current Actual, Harness-computed comparison/verdict, attributable static-production or direct-process observation, causal Counterfactual evidence and current Final-Gate snapshot proof. `machine_accepted_external_pending` proves only the admitted machine scope. Harness cannot discover undeclared requirements or prove arbitrary physical/external observation sound.
 
-Compile derives an internal `CompiledObservationAuthority` for every machine Claim or Fact × required-method obligation; it is not a new Contract Authority, state or registry. `package_static_json_exact` reads plain exact implementation/configuration content only from a UTF-8 JSON production carrier that exists in the pre-run snapshot, retains its no-follow identity/digest after the runner, matches the Binding and is not Source/Context/Contract/expected/evidence/report/status/verifier output; prepare-all mutation observation plus pre/post identity/hash rejects transient/persistent swaps, and the adapter proves no runtime consumption. `package_process_json_exact` supports only a Source-backed `runtime_family: process`, `role: product` target and a direct root `project_binary` whose target and complete argv match that authority. Each required target has one canonical Source technical-obligation target covering key, role, family, root, complete argv and capabilities. Compile derives one declaration-stable runtime closure containing the exact Source-backed root, exact Claim/Counterfactual production carriers and only finite argv values that match a production Binding by exact path or pattern. It examines a standalone argument or explicit `--key=value`, resolves safe repository-relative values from declared `cwd`, supports glob-owned and extensionless files, and ignores unmatched safe relative values without copying them. Absolute paths, repository escapes, `file:` URLs and network URLs fail closed unless explicitly routed to the external boundary. Compile neither broadly role-scans nor copies all `input_paths`; role separation covers actual closure members. Global Checks use internal scoped Binding records `{ outcome_key, local_key, binding_ref, binding }` with `<outcome>.<binding>`, preserving logical refs while deduplicating identical physical paths without changing authored Contract Bindings or adding a registry. Exact planned closure members may be absent through Compile but must materialize at Final Gate. The closure excludes Source/Context/Contract/canonical expected, verification inputs, expected outputs/artifacts, evidence/status/report/comparison/Receipt/Long-Task workdir and historical session/evidence. Harness copies only that closure into an OS-temporary snapshot and binds its identity into host attestation. Compatible Cross-Check and implicit-preserved Facts share one bounded `ty-context-product-observation-v1` stdout envelope while retaining independent result identities. An unsupported embedded dependency or Claim requires External Confirmation. Project results remain v3; no v4, general UI/native observer or language dependency parser is introduced.
+Compile derives an internal `CompiledObservationAuthority` for every machine Claim or Fact × required-method obligation; it is not a new Contract Authority, state or registry. `package_static_json_exact` reads plain exact implementation/configuration content only from a UTF-8 JSON production carrier that exists in the pre-run snapshot, retains its no-follow identity/digest after the runner, matches the Binding and is not Source/Context/Contract/expected/evidence/report/status/verifier output; prepare-all mutation observation plus pre/post identity/hash rejects transient/persistent swaps, and the adapter proves no runtime consumption. `package_process_json_exact` supports only a Source-backed `runtime_family: process`, `role: product` target and a direct root `project_binary` whose target and complete argv match that authority. Each required target has one canonical Source technical-obligation target covering key, role, family, root, complete argv and capabilities. Compile derives one declaration-stable runtime closure containing the exact Source-backed root, exact Claim/Counterfactual production carriers and only finite argv values that match a production Binding by exact path or pattern. Each argv member remains the exact child-visible token; the closed grammar examines an independent token or explicit `--name=value` without splitting spaces, stripping quotes or rewriting backslashes. Raw token and derived locator remain distinct. Quote-bearing, POSIX/UNC absolute, drive-prefixed, slash/backslash-platform-ambiguous, scheme-shaped colon prefixes outside the exact lowercase decimal `node:<number>` allowlist and unsupported compound forms fail closed unless explicitly routed to the external boundary. Cwd resolution precedes repository containment, so in-repository parent traversal is valid while a true escape is not. Glob-owned, extensionless and space-containing files remain valid; unmatched safe values and the exact lowercase decimal `node:<number>` and digits-only `<hours>:<minutes>` colon scalars are allowed but not copied. Compile neither broadly role-scans nor copies all `input_paths`; role separation covers actual closure members. Global Checks use internal scoped Binding records `{ outcome_key, local_key, binding_ref, binding }` with `<outcome>.<binding>`, preserving logical refs while deduplicating identical physical paths without changing authored Contract Bindings or adding a registry. Exact planned closure members may be absent through Compile but must materialize at Final Gate. The closure excludes Source/Context/Contract/canonical expected, verification inputs, expected outputs/artifacts, evidence/status/report/comparison/Receipt/Long-Task workdir and historical session/evidence. Harness copies only that closure into an OS-temporary snapshot, binds its identity into host attestation and forwards unchanged argv. Compatible Cross-Check and implicit-preserved Facts share one bounded `ty-context-product-observation-v1` stdout envelope while retaining independent result identities. An unsupported embedded dependency or Claim requires External Confirmation. Project results remain v3; no v4, shell/URI/dependency parser or general UI/native observer is introduced.
 
 Project-submitted v3 actual/value digest, comparison, `passed`, verdict and capability records are compatibility diagnostics only and never own Actual or completion. Current package derivation covers exact/presence plus host `target_runtime`; `interaction_trace`, `state_delta`, `design_conformance` and every capability without package derivation require blocking External Confirmation. Custom/`named_external_tcb` Oracle, wrapper, browser/native/device, layout/pixel/accessibility/motion, protected, tolerance/mask and custom-locator observation are likewise unsupported. Machine Counterfactuals require package-admitted baseline/mutated observations with the same compiled closure identity, a mutation target in its production-carrier set, exact affected/preserved/allowed-fan-out accounting, equal obligation universes and host-derived process liveness; absence of admitted observation never skips validation. Migration never silently changes the observer choice, and target/closure TCB changes invalidate prior Active Authority, Progress, Evidence and Receipt acceptance.
 
@@ -360,19 +364,25 @@ Before the first successful formal Compile, `delivery-contract.yaml` is one non-
 
 The Long-Task Skill keeps objective/boundary/activity routing in its main file and loads one-level Source-bound Draft/Contract-mapping, evidence-design and authority-lifecycle references as applicable. Draft input repair and Contract mapping are concurrent activities, not serial phases. This is instruction packaging only, not a second authority. It performs the shared Architecture Deliberation and applicable-quality routing during Draft authoring. Declared independently falsifiable architecture or engineering-quality invariants use existing Source-backed obligations/constraints/forbidden shortcuts, owner/path/Binding boundaries, project-owned executable Checks and separate Assertions when functional behavior could pass independently. Final Gate is the sole Long-Task Engineering Quality/Architecture Conformance carrier and proves only that declared project-check-bound set.
 
-A Draft Outcome is simply an Outcome before Authority Lock. Outcomes decompose independently observable, decidable and target-verifiable results to project acceptance/verification readiness, localize failures, resume findings and invalidate stale results. `depends_on` means acceptance and intermediate-proof readiness, not implementation permission, and the Rolling Frontier is a temporary advisory projection. The current Goal chooses implementation order and may optionally use one or multiple platform-native agents/subagents; Harness creates no delegation runtime, scheduler, state or proof, agent reports are non-authoritative, and all accepted output converges into the selected verification workspace. An Outcome is not a Worker, scheduler task, queue or parallel unit. Outcome decomposes diagnosis and proof ownership, not completion authority, so one complete current-snapshot Final Gate remains mandatory.
+A Draft Outcome is simply an Outcome before Authority Lock. Outcomes decompose independently observable, decidable and target-verifiable results to project acceptance/verification readiness, localize failures, resume findings and invalidate stale results. `depends_on` means acceptance and intermediate-proof readiness, not implementation permission, and the Rolling Frontier is a temporary advisory projection. The current Goal chooses implementation order. After the checkpoint it applies the Skill's packet-first positive-default rule, including actual exact calls, six-reason zero-start handling and partial delegation; decomposition and count remain dynamic. Harness creates no delegation runtime, scheduler, state or proof, agent reports are non-authoritative, and all accepted output converges into the selected verification workspace. An Outcome is not a Worker, scheduler task, queue or parallel unit. Outcome decomposes diagnosis and proof ownership, not completion authority, so one complete current-snapshot Final Gate remains mandatory.
 
 When a declared result can pass on a proxy surface while failing in its target runtime, the earliest owning Outcome carries either an admitted direct-process root Check or blocking External Confirmation. A project payload, report, screenshot, binary, log, historical run, new session id or proxy cannot be runtime authority. Applicability and all Claim/proof cells remain independently attributable; project capability records are diagnostic, and only currently admitted exact/presence and host `target_runtime` results can satisfy their matching all-of cells. Every unsupported capability remains external. Every behavioral machine Assertion has a same-Check Counterfactual whose admitted affected Facts change, preserved Facts/liveness do not, other changes are explicit fan-out and obligation universes are equal. A Binding/path is not reachability proof: static mutation proves only that structure; runtime reachability requires Harness mutation → direct product-root execution → package-observed Actual change. Evidence/status/report/Receipt/verifier outputs cannot be production carriers. Existing minimal invalidation-envelope, targeted-feedback and current Final-Gate rules remain; no generic reachability scanner, implementation Gate, scheduler or state is added.
 
-Direct-process Compile uses one declaration-stable closure of the exact Source-backed root, exact production carriers and finite argv values that match a production Binding by exact path or pattern. It examines only a standalone argument or explicit `--key=value`, resolves safe repository-relative values from declared `cwd`, supports glob-owned and extensionless files, and ignores unmatched safe relative values without copying them. Absolute paths, repository escapes, `file:` URLs and network URLs fail closed unless explicitly routed to the external boundary. Compile neither broadly role-scans nor copies all `input_paths`; role separation covers actual closure members. Global Checks use internal scoped Binding records `{ outcome_key, local_key, binding_ref, binding }` with `<outcome>.<binding>`, preserving logical refs while deduplicating identical physical paths without changing authored Contract Bindings or adding a registry. Exact planned closure members may be absent during Preflight/Compile but must exist at Final Gate. Compatible Cross-Check Facts reuse one Raw Execution/stdout envelope while keeping independent exact results.
+Direct-process Compile uses one declaration-stable closure of the exact Source-backed root, exact production carriers and finite argv values that match a production Binding by exact path or pattern. Every argv member stays the exact child-visible token. The closed grammar examines an independent token or explicit `--name=value`, never splits whitespace, unwraps quotes or rewrites backslashes, and keeps the raw token separate from its cwd-resolved repository locator. Quote-bearing, POSIX/UNC absolute, drive-prefixed, platform-ambiguous, scheme-shaped colon prefixes outside the exact lowercase decimal `node:<number>` allowlist and unsupported compound forms fail closed unless explicitly routed to the external boundary. Cwd-contained parent traversal, glob-owned, extensionless and space-containing paths remain valid; unmatched safe values and the exact lowercase decimal `node:<number>` and digits-only `<hours>:<minutes>` colon scalars are allowed without copying. Compile neither broadly role-scans nor copies all `input_paths`; role separation covers actual closure members. Global Checks use internal scoped Binding records `{ outcome_key, local_key, binding_ref, binding }` with `<outcome>.<binding>`, preserving logical refs while deduplicating identical physical paths without changing authored Contract Bindings or adding a registry. Exact planned closure members may be absent during Preflight/Compile but must exist at Final Gate. Compatible Cross-Check Facts reuse one Raw Execution/stdout envelope while keeping independent exact results.
 
 Global and Outcome applicability profiles bind the exact target, journey role, atomic dimensions, Given condition/input/state refs and ordered When refs. Every Claim-bearing Assertion remains local to one matching profile and every actually applicable proof-surface cell remains mandatory.
 
-Long-Task Anti-Degradation Assurance protects current causal-chain truth, cross-version interception strength and the adjacent `F = Implementation Freedom Boundary`. Current-implementation Context must match the indexed code/runtime, which must still realize the two necessary meaning-capture and fail-closed final-proof responsibilities under the explicit theorem boundary. `F` is an efficiency/anti-process-bloat invariant, not a third responsibility or theorem premise: within Source/Contract, architecture, safety, forbidden-shortcut and irreversible/external-action boundaries, implementation order, methods, feedback cadence and optional one-agent or multi-agent/subagent execution remain Goal-owned. Harness adds no development phase/method Gate, per-edit mandate, agent scheduler/state or delegation proof. Weakening the protected purpose, key logic, either responsibility, theorem boundary or `F` requires an explicit project-owner design-purpose decision and replacement proof. A new development-stage constraint must also close a distinct path that final proof or a lighter project-owned check cannot cover and demonstrate positive net ROI—specifically evidenced high total-cost ROI and high efficiency—after the hard safety and proof constraints. High means a significant stable margin, not a global/local optimum. Once validity, relative non-degradation, must-allow behavior, structural-cost limits and applicable measured total-cost thresholds close, construction stops unless a new real counterexample, repeated material cost hot spot or evidence of significant additional net benefit appears. Existing Context, indexes, tests, critical sentinels, routing and parity gates carry this assurance without another Authority, Gate or state; they cannot infer omitted requirements or guarantee immutability against deliberate fully authorized joint weakening.
+Long-Task Anti-Degradation Assurance protects current causal-chain truth, cross-version interception strength and the adjacent `F = Implementation Freedom Boundary`. Current-implementation Context must match the indexed code/runtime, which must still realize the two necessary meaning-capture and fail-closed final-proof responsibilities under the explicit theorem boundary. `F` is an efficiency/anti-process-bloat invariant, not a third responsibility or theorem premise: within Source/Contract, architecture, safety, forbidden-shortcut and irreversible/external-action boundaries, implementation order, methods, feedback cadence, concrete packet decomposition and dynamic worker count remain Goal-owned. The current positive-default rule requires multiple exact workers only for the bounded qualifying predicate above and otherwise requires one admitted solo reason; Harness adds no development phase/method Gate, per-edit mandate, fixed allocation, agent scheduler/state or delegation proof. Weakening the protected purpose, key logic, either responsibility, theorem boundary or `F` requires an explicit project-owner design-purpose decision and replacement proof. A new development-stage constraint must also close a distinct path that final proof or a lighter project-owned check cannot cover and demonstrate positive net ROI—specifically evidenced high total-cost ROI and high efficiency—after the hard safety and proof constraints. High means a significant stable margin, not a global/local optimum. Once validity, relative non-degradation, must-allow behavior, structural-cost limits and applicable measured total-cost thresholds close, construction stops unless a new real counterexample, repeated material cost hot spot or evidence of significant additional net benefit appears. Existing Context, indexes, tests, critical sentinels, routing and parity gates carry this assurance without another Authority, Gate or state; they cannot infer omitted requirements or guarantee immutability against deliberate fully authorized joint weakening.
+
+Mechanism/release claims progress only through designed, implemented, known-counterexample protection, and high-quality realization within an explicit TCB. This observer revision remains Level 3. R9/R10 each preserve unused non-closure must-allow, non-closure-read runtime-isolation rejection and explicit bound-closure role-conflict Compile rejection as three independent proofs. The raw-argv incident is instead owned by its focused regression, complete current-candidate lifecycle matrix and independent audit; the historical ROI workload does not prove it and adds no `CASE_ID`. A complete committed attack candidate plus owner diagnostic proves the Compile boundary; a legal-neighbor Authority followed by freshness rejection on that same candidate separately proves Final-Gate non-reuse. `active_task_missing`, dirty-candidate rejection and a fresh Compile rejection are not substitutes. The current machine report owns the exact attack/control population without another registry. Level 4 keeps the unchanged complete total-cost ROI theorem, independent capability-audit requirement and separate explicit project-owner promotion. No surrogate tokenizer, prose, test count, fresh-Agent pair, observed lifecycle win or sanitized fixture can promote it.
+
+The repository-owned eight-Fact A/B/C benchmark records each fixture's committed candidate identity and requires it to remain clean and unchanged. Real-process v5 always collects all five A/B/C repeat orders. One package materializer alone performs detached checkout, install, build, source-parity verification and script-disabled pack and binds exact commit/tree/lockfile/runtime. Workload/collection owns only raw and `observed_lifecycle_*` facts; aggregate/attestation status is `not_evaluated`; the formal-v2 packet maps paths only. After validating the actual manifest-v2 run set, the existing verifier creates the immutable artifact index and alone derives evidence admission, normalization, exclusive event ownership, `total_roi_supported`, `total_roi_positive` and formal status. Packet-authored bytes, roles, digests, verification flags, normalized values, monetary incident totals or event IDs are rejected. The verifier binds exact A/B/C materialized-package, benchmark implementation, acquisition runtime/TCB, scenario, collector, precollection, retention and redaction identities. The delivery-specific policy uses 1 NCU=CNY 1, CNY 200/50 hourly active/wait proxies, a ten-delivery cycle, five-pair median projection for repeatable costs, once-per-cycle maintenance/recovery, once-only introduction/adoption/migration and one controlled-incident benefit median. Provider/compute/storage derive from prelocked invoice/official-price sources and incident benefit from raw time/usage. Benefit must be at least 1.25 times positive incremental cost; at least 4/5 paired nets must be positive and sample CV at most 20%. Missing evidence remains unsupported. Provider-event v1-v2, the other listed formal v1 schemas, real-process v1-v4 and manifest v1 require recollection; machine measurement, independent audit and explicit project-owner promotion remain separate.
+
+The exact current schema matrix is accounting-policy, evidence-packet, precollection-plan, raw-event, scenario-catalog and source-manifest v2; Provider event v3; real-process v5; and run-set manifest v2. Provider-event v1-v2, the other listed formal v1 schemas, real-process v1-v4 and manifest v1 require recollection; `next` is unassigned.
 
-Mechanism/release claims progress only through designed, implemented, known-counterexample protection, and high-quality realization within an explicit TCB. This observer revision remains Level 3. R9/R10 each preserve unused non-closure must-allow, non-closure-read runtime-isolation rejection and explicit bound-closure role-conflict Compile rejection as three independent proofs. A complete committed attack candidate plus owner diagnostic proves the Compile boundary; a legal-neighbor Authority followed by freshness rejection on that same candidate separately proves Final-Gate non-reuse. `active_task_missing`, dirty-candidate rejection and a fresh Compile rejection are not substitutes. The current machine report owns the exact attack/control population without another registry. Level 4 keeps the unchanged complete total-cost ROI theorem and independent capability-audit requirement. No surrogate tokenizer, prose, test count, fresh-Agent pair, observed lifecycle win or sanitized fixture can promote it.
+Formal collection prelocks one fixed eleven-scenario catalog as the sole source/zero-policy owner; collectors declare capabilities only and sources are only `required|forbidden`. Human time comes from a runner interaction recorder, compute from the complete Job-contained process tree, State from an exact runner payload/ledger plus prefrozen retention, and Provider usage from invocation-bound Provider correlation. A module-private-branded acquisition runtime constructs those owners and rejects missing sources, sampling/default-zero proxies, ordinary-spawn fallback and stream overflow. Every event binds a unique raw output and the scenario gold comparison remains verifier-owned. Provider acquisition now captures the exact prompt in the parent and launches only the candidate-owned isolated Node worker through a sanitized, runtime-TCB-v2-bound envelope. The worker alone owns `node:https`, bounded response streaming and the fixed parser; protocol-owned request/response/stdout/stderr/deadline/abort/output-token limits and complete temporary-root cleanup fail closed. The event binds response digest plus parser/worker identities without claiming an independent reparse of unretained response bytes. Provider readiness means only that local configuration, credential presence and launch support permit one controlled attempt.
 
-The repository-owned eight-Fact A/B/C benchmark records each fixture's committed candidate identity, binds it to parsed raw HEAD/tree/status command records before and after lifecycle execution, and requires a clean unchanged candidate. It may expose versioned, recomputable `observed_lifecycle_*` facts, but those facts have no admission meaning and never use `qualified_positive_*`. Complete total-cost support requires independently attributable verified Authoring, Runtime, State, Recovery, maintenance, test, process, introduction, adoption and migration evidence. The current v2 implementation has no independent formal-cost evidence ingestion and admits no self-attested `verified` row; any missing, unverified or unadmitted category forces `total_roi_supported=false` and forbids `total_roi_positive=true`. Machine measurement and independent governance admission remain separate, and schema changes require a new version or an explicit tested compatibility reader that preserves missing evidence.
+The catalog derives 86 executions and 586 formal artifacts. Formal capacity is 650 files/364.625 MiB and complete run-set capacity is 4,379 files/974.3125 MiB. The Evidence Candidate freezes every code/schema/Context/test/package-version/protocol byte. Its Promotion Commit must be the direct child, add only four fixed package-/TCB-external governance records and preserve materialized-package, benchmark and runtime/TCB identities. Real collection is `external_pending` until authorized original/sanitized incident provenance, invocation-bound Provider/price evidence and a State-retention Source exist; synthetic fixtures cannot promote Level 3. Package 0.8.15 is the historical frozen Evidence Candidate identity. Package 0.8.16 is the current Level-3 package candidate, inherits none of that evidence, production-checks the finite benchmark local-dependency closure—including `npm_command_spec.mjs`, the Provider protocol/worker sources and the Promotion commit-boundary owner—and requires collection/Promotion verifier execution from the exact repository checkout. This completes the scoped Level-4 mechanism logic only: capability remains Level 3, `level_4_claimed=false`, no formal-positive or Promotion exists, public `independent_evidence_admitted` means packet structure/source binding only, and complete/positive ROI remain owned by `total_roi_supported`/`total_roi_positive`.
 
 The mechanism's own Final-Gate Oracle consumes fixed-test-ID machine reports and compares complete wrong-candidate and correct-control workflow statuses. Runtime capability requires `wrong candidate != machine_accepted` and `correct candidate == machine_accepted` through the real lifecycle; command exit plus token/string presence proves documentation consistency only. A separate ROI verifier never contributes to a safety Fact verdict.
 
@@ -390,22 +400,22 @@ The first successful Compile creates Authority Lock and returns:
     "required": true,
     "phase": "post_authority_lock_pre_implementation",
     "action": "change_model_in_host_then_continue",
-    "resume_token": "continue",
+    "resume_token": "model checkpoint cleared, continue",
     "turn_boundary": "end_current_turn",
     "blocked_until_resume": ["product_implementation", "file_edits", "build", "test_execution"],
     "model_change_owner": "host_or_user",
     "model_change_observable_by_harness": false,
-    "generic_continue_satisfies": true,
-    "message": "After handling the model change, send [continue]."
+    "generic_continue_satisfies": false,
+    "message": "After handling the model change, reply exactly: model checkpoint cleared, continue."
   }
 }
 ```
 
-This is an unconditional terminal-turn boundary. The Agent performs no product implementation, file edit, build or test after that result, says `After handling the model change, send [continue].` and ends the turn. Earlier model wording never skips the boundary; a later ordinary `continue` resumes execution, while Harness neither observes nor verifies whether the host model changed. Later Compile revisions return `{ "required": false }` and do not repeat it.
+This is an unconditional terminal-turn boundary. The Agent performs no product implementation, file edit, build or test after that result, says `After handling the model change, reply exactly: model checkpoint cleared, continue` and ends the turn. Earlier model wording never skips the boundary and a generic continuation does not satisfy the package-managed prompt protocol. Harness observes neither the next host message nor whether the model changed, so this remains manual host guidance rather than a machine-enforced unlock. Later Compile revisions return `{ "required": false }` and do not repeat it.
 
-Harness cannot switch the host-selected model. It creates no checkpoint file, acknowledgement state, model route, model-tier scheduler or automatic model switch. The checkpoint is a one-time host affordance enabled by locked Authority and Final Gate protection; it is not acceptance evidence. Once resumed, the parent judges Delegation Suitability and proactively uses the fixed worker for independent bounded work whose benefit exceeds coordination cost; multiple disjoint instances are allowed, while the parent retains every authority, integration and formal-verification responsibility.
+Harness cannot switch the host-selected model. It creates no checkpoint file, acknowledgement state, model route, model-tier scheduler or automatic model switch. The checkpoint is a one-time host affordance enabled by locked Authority and Final Gate protection; it is not acceptance evidence. Once resumed, the parent applies the Skill's packet-first positive-default rule: a qualifying set requires actual calls for multiple exact `long_task_implementation` workers, while host results determine zero-start or partial fallback. Count remains dynamic, and the parent retains every authority, architecture, Context, integration, current-candidate check, formal-verification, Final-Gate, close and completion responsibility.
 
-Post-lock revisions separate authority change from user decision while retaining exact identity, old-Authority continuity, compare-and-swap adoption, evidence invalidation and the complete Final Gate. Formally monotonic strengthening; raw Source/Context snapshot changes with unchanged locked Claims/targets/proof obligations; operational Runner/input/environment repair; repository-bound scope expansion; risk strengthening; and equivalent Counterfactual coverage with the same carrier, mutation and Check and no lost Claim/assertion-failure coverage auto-adopt. Product/Source Claim/target/external-confirmation changes, lost scenario/Claim/Evidence Capability/failure interception, forbidden or owner-Context removal, runner type/effect changes, verifier-kernel changes and unknown reasons are preview-only and require the exact revision identity; risk downgrade is rejected. `diagnose-revision` remains side-effect-free and can exercise eligible scope candidates, so withdrawn/replaced candidates coalesce in the same `delivery-contract.yaml` and never ask. The final pending decision begins with a plain-language Authority Revision introduction and separates `user_decision_reasons` from mechanically bounded changes. Present it first. An explicit current-task instruction that exactly covers every listed decision reason may be mechanically relayed without a second question; generic continue, blanket approval, recommendation or Agent inference does not count. Exact identity, previous-Authority continuity, evidence invalidation and the complete Final Gate apply to every adoption, which reports `delivery_completed_by_this_event: false`, returns to rolling implementation or repair and never means delivery completion.
+Post-lock revisions separate authority change from user decision while retaining exact identity, old-Authority continuity, compare-and-swap adoption, evidence invalidation and the complete Final Gate. Formally monotonic strengthening; raw Source/Context snapshot changes with unchanged locked Claims/targets/proof obligations; operational Runner/input/environment repair; repository-bound scope expansion; risk strengthening; and equivalent Counterfactual coverage with the same carrier, mutation and Check and no lost Claim/assertion-failure coverage auto-adopt. Product/Source Claim/target/external-confirmation changes, lost scenario/Claim/Evidence Capability/failure interception, forbidden or owner-Context removal, runner type/effect changes, verifier-kernel changes and unknown reasons are preview-only and require the exact revision identity; risk downgrade is rejected. A verifier-content identity change invalidates prior evidence and remains fail-closed when semantic preservation lacks independent previous-Authority or trusted release proof, but the digest delta alone is not reported as a concrete acceptance/proof reduction; the brief names changed verifier files and the unproven-preservation boundary. `diagnose-revision` remains side-effect-free and can exercise eligible scope candidates, so withdrawn/replaced candidates coalesce in the same `delivery-contract.yaml` and never ask. The final pending decision begins with a plain-language Authority Revision introduction and separates `user_decision_reasons` from mechanically bounded changes. Present it first. An explicit current-task instruction that exactly covers every listed decision reason may be mechanically relayed without a second question; generic continue, blanket approval, recommendation or Agent inference does not count. Exact identity, previous-Authority continuity, evidence invalidation and the complete Final Gate apply to every adoption, which reports `delivery_completed_by_this_event: false`, returns to rolling implementation or repair and never means delivery completion.
 
 ```text
 ty-context long-task init <workdir>
@@ -488,7 +498,7 @@ make validate-harness
 
 The modularity gate is the capability-aware `ty-context check-modularity`. Scoped waivers require `owner`, `introduced_at`, `reason`, `tracking_issue` and `expiry_condition`; unsupported metrics never appear as passing zeroes.
 
-The synchronized local preview tarball is named `project-tiny-context-harness-0.8.13.tgz`.
+The synchronized local preview tarball is named `project-tiny-context-harness-0.8.16.tgz`.
 
 ## Community And Further Reading
 
@@ -507,7 +517,7 @@ For concrete examples, see the [fresh-agent recovery walkthrough](https://github
 
 ## Honest Limits
 
-Tiny Context does not create or restore a platform Goal, prove that every requirement was declared, guarantee bounded keyword search finds every synonym or indirect dependency, switch the host-selected model, provide a parallel mutation/delegation runtime, observe platform tokens/model calls, or own Git/PR/CI/deployment/human product confirmation. The default Workflow provides model-led, evidence-bounded conformance, not exact declared-scope zero-drift proof or machine completion authority; unverified and externally pending scope must remain explicit. A platform Goal may use opaque implementation delegation, but Harness does not persist or accept it as evidence. The installed package verifier and Git metadata are trusted; external platforms own network isolation, and deliberate same-user/admin tampering remains outside the local threat model.
+Tiny Context does not create or restore a platform Goal, prove that every requirement was declared, guarantee bounded keyword search finds every synonym or indirect dependency, switch the host-selected model, provide a parallel mutation/delegation runtime, observe platform tokens/model calls, or own Git/PR/CI/deployment/human product confirmation. The default Workflow provides model-led, evidence-bounded conformance, not exact declared-scope zero-drift proof or machine completion authority; unverified and externally pending scope must remain explicit. When the package-managed Skill's bounded predicate holds, the platform Goal must make actual host calls for multiple exact `long_task_implementation` workers; Harness never allocates, persists or treats that dispatch as evidence. The installed package verifier and Git metadata are trusted; external platforms own network isolation, and deliberate same-user/admin tampering remains outside the local threat model.
 
 ## License
 

package/assets/README.md

@@ -112,7 +112,7 @@ Use this route when an implementation delivery both genuinely needs new style-be
 2. **Establish Design Authority only when needed.** If the project has no adopted Design Authority and the work is style-bearing, explicitly select `$design-system-authoring` to generate, select and adopt the canonical `DESIGN.md`, token source and provider binding. Skip this step when the project already has a configured Design Authority.
 3. **Prepare a writable initial proposal.** Put the project-native product/technical proposal at a concrete path such as `docs/initial-proposal.md`. It may be authored by the user, an external service or an explicitly requested applicable proposal capability. `design-resource-authoring` does not author the initial proposal, and no standalone intermediary authoring stage is required.
 4. **Generate and select design resources.** Select `$design-resource-authoring` with the proposal path plus the exact development scope and targets. It returns one reconciled proposal, the selected immutable canonical resources with their manifest and dependencies, and a validated residual `design-resource-handoff-v1`.
-5. **Start the Single-Goal delivery.** Select `$long-task-workflow` and give it the exact paths to the reconciled proposal, validated handoff and selected canonical resource set. The Skill authors the Source-bound Contract Draft. Its first Compile/Authority Lock always ends the current turn before implementation and says `After handling the model change, send [continue].`; earlier model wording cannot skip this boundary and Harness cannot observe whether the host model changed. After the user resumes, the parent evaluates delegation suitability and delegates independent bounded work only when the host explicitly selects exact `long_task_implementation`; otherwise it executes in the parent without a generic substitute. The parent still owns authority, architecture, Context, integration, current-candidate checks and formal verification.
+5. **Start the Single-Goal delivery.** Select `$long-task-workflow` and give it the exact paths to the reconciled proposal, validated handoff and selected canonical resource set. The Skill authors the Source-bound Contract Draft. Its first Compile/Authority Lock always ends the current turn before implementation and says `After handling the model change, reply exactly: model checkpoint cleared, continue`; a generic continuation does not satisfy the managed prompt protocol, earlier model wording cannot skip the boundary, and Harness cannot observe the next host message or whether the model changed. After the user resumes, the parent identifies qualifying bounded packets before profile/capacity. Absent an explicit user or host prohibition, a qualifying set requires actual host calls for multiple exact `long_task_implementation` workers; host results determine zero-start or partial fallback under the Skill's six-reason rule. Worker count stays dynamic, generic substitutes remain forbidden, and the parent alone owns Source, Contract, Authority, architecture, Context, packet selection, integration, current-candidate checks, formal verification, Final Gate, close and completion.
 
 One concrete invocation sequence is:
 
@@ -187,7 +187,7 @@ The smoke packs the local workspace, installs it into a disposable repo and vali
 
 ```sh
 cd /path/to/your/test-repo
-npm install -D /path/to/project-tiny-context-harness/tmp/ty-context/source-preview/package/project-tiny-context-harness-0.8.13.tgz
+npm install -D /path/to/project-tiny-context-harness/tmp/ty-context/source-preview/package/project-tiny-context-harness-0.8.16.tgz
 npx --no-install ty-context init --adopt
 make validate-context
 ```
@@ -328,6 +328,8 @@ The default Workflow performs UI Authority Closure and a conditional Design Auth
 
 For selected implementation handoff files, DSA first publishes the exact target set with `ty-context design-resource bundle`; both development paths rerun `ty-context design-resource preflight <handoff.md>` on every published file. Incomplete acquisition, missing or undeclared dependencies or targets, duplicate targets, unsafe paths, stale manifest/file digests, fictional locators, non-frozen or incomplete Census, sampled/truncated generation, aggregate axis values, mismatched Expected/Canonical/Handoff Fact sets, missing required methods, invalid comparator/Oracle/environment binding, unresolved design-system lineage, uncovered applicable cells, absent exact-target layout/pixel facts, unsupported evidence and unresolved meaning all fail closed. Each workflow must still open the resources and prove the production implementation on the real entry.
 
+In Long-Task projection, every Claim-bearing Assertion remains single-Claim. For each selected-design verification method, the target's root conformance Assertion and that method's independent Assertion jointly cover the Source Claims referenced by its Facts or Rules; the union closes coverage without collapsing method capabilities, evidence, results or failure attribution.
+
 For material work, `context_uiux_design` applies the projection above and keeps risk-proportional coverage reasoning task-local. `context_development_engineer` traces every affected selected target and declared condition through stable surface/control keys to the production route/component owner, cold-start real-user journey and applicable rendered/interactive checks. A first useful runnable production slice is a recommended real-entry feedback point when early localization is worth the cost, never an implementation gate; the final candidate always reruns the affected cold-start journey. Source-required combinations cannot be silently pruned, but default work reports conditions it did not establish instead of claiming exact machine closure. Resource hashes, manifests and counts prove integrity only; an implementation screenshot cannot become its own target or implementation-conformance proof.
 
 An explicit Long-Task is the strong authority carrier of the same shared obligation. It resolves missing/conflicting UI authority before Compile, then closes all 22 canonical fields of every real Product Control through `field_coverage`; that semantic Control projection is independent of, and never caps, the finer design Fact universe. Selected targets freeze the canonical manifest identity/digest and project every atomic Fact/required-method pair into a `fact_expectations` row with subject/target/condition/variation/property identity, expected located-value digest, comparator/parameters/tolerance/mask, Oracle identity/capabilities, environment and sensitivity. Only a package-admitted observer may supply the matching `fact_results` Actual/comparison row. In the current slice, project `design_conformance`, `design_method` and `fact_results` records are diagnostic; affected UI/design obligations remain blocking External Confirmations rather than machine proof. Product `surface_bindings`, Control Claims/relations and root-entry journeys continue to carry product semantics, while existing Claim, Assertion, Check, Stage, Binding, revision and Final Gate mechanisms remain the sole Long-Task lifecycle and closure. Every blocker preserves exact Source-item/method/capability lineage and cannot be dismissed in-band; scope removal requires revised Source/Contract authority.
@@ -389,7 +391,7 @@ Use `long-task-workflow` only when explicitly selected or when the current workt
 
 Its proof claim is conditional and precise: if Source is complete and accurate at the declared observable granularity, projection preserves that meaning and every actual applicability cell is expanded, then `AcceptedDeliveryTerminal`—exactly a fresh `machine_accepted` result with no pending External Confirmation—implies no declared machine-observable drift remains only because every machine obligation has frozen Expected authority, package-admitted current Actual, Harness-computed comparison/verdict, attributable static-production or direct-process observation, causal Counterfactual evidence and current Final-Gate snapshot proof. `machine_accepted_external_pending` proves only the admitted machine scope; full delivery remains qualified and the native Goal is untouched. The workflow cannot discover undeclared requirements or prove arbitrary physical/external observation sound.
 
-Compile derives an internal `CompiledObservationAuthority` projection for every machine Claim or Fact × required-method obligation; it is not a new Contract Authority, state or registry. The first admitted slice has only two machine paths. `package_static_json_exact` reads plain exact implementation/configuration content from a UTF-8 JSON production carrier that already exists in the pre-run snapshot, retains the same no-follow file identity/digest after the runner, matches the Binding and is not Source/Context/Contract/expected material or evidence/report/status/verifier output; Harness selects the fixed RFC 6901 `/observations/<stable Fact-or-obligation identity>` locator and applies package duplicate-key/UTF-8/size/depth/pointer limits. Prepare-all mutation observation plus per-file pre/post identity/hash rejects transient and persistent runner swaps; it proves static content, not runtime consumption. `package_process_json_exact` applies only to a Source-backed `runtime_family: process`, `role: product` target and a direct root `project_binary` whose target and complete argv match that authority. Each required target has one canonical Source technical-obligation target covering key, role, family, root, complete argv and capabilities. Compile derives one declaration-stable process-runtime closure containing the exact Source-backed root, exact Claim/Counterfactual production carriers and only finite argv values that resolve to a production Binding. It examines a standalone argument or explicit `--key=value`, resolves safe repository-relative values from the declared `cwd`, and admits a path only when an exact or pattern Binding covers it; glob-owned and extensionless files are supported. An unmatched safe relative value is ignored and not copied. Absolute paths, repository escapes, `file:` URLs and network URLs fail closed unless their semantics are explicitly routed to the existing external TCB/External Confirmation boundary. Compile neither broadly role-scans nor copies all `input_paths`; role separation applies only to actual closure members. Global Checks project Outcome Bindings into internal `{ outcome_key, local_key, binding_ref, binding }` records using `<outcome>.<binding>`: logical refs remain distinct while identical physical paths may be copied once, with no authored-Contract or registry change. Exact planned closure members may be absent through Compile but must materialize at Final Gate. Harness copies only that closure into an OS-temporary snapshot and binds its identity into host attestation. The child receives the minimal runner environment with no observation-path, challenge or protocol variable and emits exactly one bounded `ty-context-product-observation-v1` envelope on stdout; compatible Cross-Check and implicit-preserved Facts share that Raw Execution/envelope while retaining independent result identities. This proves only exact values emitted by the Source-backed product root on the declared JSON output surface. An embedded dependency that cannot be explicitly production-bound or a Claim that cannot bind to that surface requires External Confirmation. The public project payload remains v3; no v4, general UI/native observer or language dependency parser is introduced.
+Compile derives an internal `CompiledObservationAuthority` projection for every machine Claim or Fact × required-method obligation; it is not a new Contract Authority, state or registry. The first admitted slice has only two machine paths. `package_static_json_exact` reads plain exact implementation/configuration content from a UTF-8 JSON production carrier that already exists in the pre-run snapshot, retains the same no-follow file identity/digest after the runner, matches the Binding and is not Source/Context/Contract/expected material or evidence/report/status/verifier output; Harness selects the fixed RFC 6901 `/observations/<stable Fact-or-obligation identity>` locator and applies package duplicate-key/UTF-8/size/depth/pointer limits. Prepare-all mutation observation plus per-file pre/post identity/hash rejects transient and persistent runner swaps; it proves static content, not runtime consumption. `package_process_json_exact` applies only to a Source-backed `runtime_family: process`, `role: product` target and a direct root `project_binary` whose target and complete argv match that authority. Each required target has one canonical Source technical-obligation target covering key, role, family, root, complete argv and capabilities. Compile derives one declaration-stable process-runtime closure containing the exact Source-backed root, exact Claim/Counterfactual production carriers and only finite argv values that resolve to a production Binding. Every `root_argv` member remains the exact child-visible token: classification never splits spaces, strips quotes or rewrites backslashes. The closed grammar examines an independent token or one explicit `--name=value`; supported standalone switches remain labels and unsupported compound syntax receives no machine closure. Raw token and derived locator stay distinct. Quote-bearing, POSIX/UNC absolute, drive-prefixed, slash/backslash-platform-ambiguous and all scheme-shaped colon-prefix references outside the exact lowercase decimal `node:<number>` allowlist fail closed before execution unless explicitly routed to the existing external TCB/External Confirmation boundary. Parent segments resolve from declared `cwd` before repository containment is decided, so an in-repository `..` is legal and a true escape is not. Exact/pattern Bindings may own glob, extensionless or space-containing files; unmatched safe values and the exact lowercase decimal `node:<number>` and digits-only `<hours>:<minutes>` colon scalars are allowed but not copied. Compile neither broadly role-scans nor copies all `input_paths`; role separation applies only to actual closure members. Global Checks project Outcome Bindings into internal `{ outcome_key, local_key, binding_ref, binding }` records using `<outcome>.<binding>`: logical refs remain distinct while identical physical paths may be copied once, with no authored-Contract or registry change. Exact planned closure members may be absent through Compile but must materialize at Final Gate. Harness copies only that closure into an OS-temporary snapshot and binds its identity into host attestation. The child receives the unchanged raw argv and the minimal runner environment with no observation-path, challenge or protocol variable, then emits exactly one bounded `ty-context-product-observation-v1` envelope on stdout; compatible Cross-Check and implicit-preserved Facts share that Raw Execution/envelope while retaining independent result identities. This proves only exact values emitted by the Source-backed product root on the declared JSON output surface. An embedded dependency that cannot be explicitly production-bound or a Claim that cannot bind to that surface requires External Confirmation. The public project payload remains v3; no v4, shell/URI/dependency parser or general UI/native observer is introduced.
 
 Project-submitted v3 actual/value digest, comparison, `passed`, verdict and capability records are compatibility diagnostics only; they never supply Actual or completion authority. The current package-derived capability slice is exact/presence plus host-derived `target_runtime`. `interaction_trace`, `state_delta`, `design_conformance` and every other capability without a package-derived implementation require blocking External Confirmation even when a project record is present. Custom/`named_external_tcb` Oracles, wrappers, browser/native/device sessions, layout/pixel/accessibility/motion, protected observation, tolerance/mask and custom locators likewise cannot machine-close an obligation. Every machine Counterfactual needs package-admitted baseline and mutated observations on the same compiled process-closure identity, a mutation target in its production-carrier set, exact affected/preserved/allowed-fan-out accounting, equal obligation universes and host-derived process liveness; no-observation never skips validation. Existing Contracts are not silently rewritten, and target/closure TCB changes invalidate prior Active Authority, Progress, Evidence and Receipts for acceptance.
 
@@ -401,23 +403,33 @@ Raw/revised proposals, selected design resources and mixed attachments enter one
 
 Before the first successful formal Compile, `delivery-contract.yaml` is one non-authoritative Contract Draft. `long-task-workflow` opens it at entry and keeps revising that same Draft across Source refinement, repository/Context reads, mapping and Preflight repair rounds; it does not require one response to produce a complete Contract. Source completeness is a convergence condition for Preflight/Compile, not a prior phase. No standalone Contract Draft Skill, Draft Receipt or Authoring State exists.
 
-The first successful Compile creates Authority Lock and always returns `execution_model_checkpoint.required: true` with `action: change_model_in_host_then_continue`, `resume_token: continue`, `turn_boundary: end_current_turn`, the blocked implementation actions, `model_change_owner: host_or_user` and `model_change_observable_by_harness: false`. The Agent performs no product implementation, file edit, build or test after that result, says `After handling the model change, send [continue].` and ends the turn. A prior textual model strategy never skips this boundary; any later user `continue` resumes it, while Harness neither observes nor verifies a model change. Later Compile revisions return `required: false`; Harness does not switch models, persist acknowledgement/model-route state or repeat the pause.
+The first successful Compile creates Authority Lock and always returns `execution_model_checkpoint.required: true` with `action: change_model_in_host_then_continue`, `resume_token: model checkpoint cleared, continue`, `generic_continue_satisfies: false`, `turn_boundary: end_current_turn`, the blocked implementation actions, `model_change_owner: host_or_user` and `model_change_observable_by_harness: false`. The Agent performs no product implementation, file edit, build or test after that result, says `After handling the model change, reply exactly: model checkpoint cleared, continue` and ends the turn. A prior textual model strategy never skips this boundary and a generic continuation is not accepted by the package-managed prompt protocol. This remains manual host guidance rather than a machine-enforced unlock: Harness observes neither the next host message nor the model change and persists no acknowledgement. Later Compile revisions return `required: false`; Harness does not switch models, persist model-route state or repeat the pause.
 
-Later revisions separate authority change from user decision. Formally monotonic strengthening; raw Source/Context snapshot changes with unchanged locked Claims/targets/proof obligations; operational Runner/input repair; repository-bound scope expansion; risk strengthening; and equivalent Counterfactual coverage with the same carrier, mutation and Check and no lost Claim/assertion-failure coverage auto-adopt. Product/Source Claim/target/external-confirmation changes, lost scenario/Claim/Evidence Capability/failure interception, forbidden or owner-Context removal, runner type/effect changes, verifier-kernel changes and unknown reasons are preview-only and require the exact revision identity; risk downgrade is rejected. `diagnose-revision` remains side-effect-free and can exercise eligible scope candidates, so withdrawn/replaced candidates coalesce in the same `delivery-contract.yaml` and never ask. The final pending decision begins with a plain-language Authority Revision introduction and separates `user_decision_reasons` from mechanically bounded changes. Present it first. An explicit current-task instruction that exactly covers every listed decision reason may be mechanically relayed without a second question; generic continue, blanket approval, recommendation or Agent inference does not count. Exact identity, previous-Authority continuity, evidence invalidation and the complete Final Gate apply to every adoption, which never means delivery completion.
+Later revisions separate authority change from user decision. Formally monotonic strengthening; raw Source/Context snapshot changes with unchanged locked Claims/targets/proof obligations; operational Runner/input repair; repository-bound scope expansion; risk strengthening; and equivalent Counterfactual coverage with the same carrier, mutation and Check and no lost Claim/assertion-failure coverage auto-adopt. Product/Source Claim/target/external-confirmation changes, lost scenario/Claim/Evidence Capability/failure interception, forbidden or owner-Context removal, runner type/effect changes, verifier-kernel changes and unknown reasons are preview-only and require the exact revision identity; risk downgrade is rejected. A verifier-content identity change invalidates prior evidence and remains fail-closed when semantic preservation lacks independent previous-Authority or trusted release proof, but the digest delta alone is not reported as a concrete acceptance/proof reduction; the brief names changed verifier files and the unproven-preservation boundary. `diagnose-revision` remains side-effect-free and can exercise eligible scope candidates, so withdrawn/replaced candidates coalesce in the same `delivery-contract.yaml` and never ask. The final pending decision begins with a plain-language Authority Revision introduction and separates `user_decision_reasons` from mechanically bounded changes. Present it first. An explicit current-task instruction that exactly covers every listed decision reason may be mechanically relayed without a second question; generic continue, blanket approval, recommendation or Agent inference does not count. Exact identity, previous-Authority continuity, evidence invalidation and the complete Final Gate apply to every adoption, which never means delivery completion.
 
 The package-managed Long-Task Skill uses progressive disclosure: its main `SKILL.md` keeps the objective, boundaries and activity routing; one-level references are read for Source-bound Draft input/Contract mapping, evidence design or authority lifecycle as applicable. Draft input repair and Contract mapping are concurrent activities, not serial phases. This reduces routine instruction load without moving any rule into a second authority. It performs the shared Architecture Deliberation and applicable-quality routing during Draft authoring. When Source or controlling Context declares an independently falsifiable architecture or engineering-quality invariant, the Contract uses existing technical obligations/global constraints/forbidden shortcuts, owner/path/Binding boundaries, a project-owned executable Check and a separate Assertion when functional behavior could pass independently. Final Gate is the sole Long-Task Engineering Quality/Architecture Conformance carrier and proves only that declared project-check-bound set.
 
-A Draft Outcome is simply an Outcome before Authority Lock. Outcomes split independently observable, decidable, vertical and target-verifiable results so the current Goal can project a smaller acceptance/verification-ready working set, localize failures, resume findings and invalidate stale local results. `depends_on` expresses acceptance and intermediate-proof readiness, not implementation permission. Every Outcome belongs to one ordered Stage; its Stage gate transitively depends on the other Outcomes in that Stage, and later Stages depend on earlier gates. The Rolling Frontier and Stage status are derived from ordinary Outcome Progress and are temporary advisory projections. The Goal may implement, inspect or repair any in-scope Outcome in the order current code favors and may optionally use one or multiple platform-native agents/subagents. Harness allocates and records none of them, agent reports are not Progress or proof, and all outputs converge into the selected verification workspace. An Outcome is not a Worker, scheduler task, queue or parallelism unit, and a Stage owns no Receipt or second Gate. Outcome decomposes diagnosis and proof ownership, not completion authority: targeted passes never replace the one complete Final Gate on the current final snapshot.
+A Draft Outcome is simply an Outcome before Authority Lock. Outcomes split independently observable, decidable, vertical and target-verifiable results so the current Goal can project a smaller acceptance/verification-ready working set, localize failures, resume findings and invalidate stale local results. `depends_on` expresses acceptance and intermediate-proof readiness, not implementation permission. Every Outcome belongs to one ordered Stage; its Stage gate transitively depends on the other Outcomes in that Stage, and later Stages depend on earlier gates. The Rolling Frontier and Stage status are derived from ordinary Outcome Progress and are temporary advisory projections. The Goal may implement, inspect or repair any in-scope Outcome in the order current code favors. After the checkpoint it applies the Skill's packet-first positive-default rule, including actual exact calls, six-reason zero-start handling and partial delegation; decomposition and count remain dynamic. Harness allocates and records none of them, agent reports are not Progress or proof, and all outputs converge into the selected verification workspace. An Outcome is not a Worker, scheduler task, queue or parallelism unit, and a Stage owns no Receipt or second Gate. Outcome decomposes diagnosis and proof ownership, not completion authority: targeted passes never replace the one complete Final Gate on the current final snapshot.
 
-The Contract declares one bounded target profile, its non-empty required product target refs and each target's runtime family, root entrypoint, complete root argv and explicit capabilities. Each required target maps through Source Claim disposition to one canonical Source technical obligation with the same target identity; the process root and every argv path actually admitted by the finite exact/pattern match additionally belong to the production owner and a production Binding. Compile derives one declaration-stable runtime closure from the root, matched argv paths and required carriers rather than copying or broadly scanning all `input_paths` or manifest siblings. A safe unmatched relative argument is not a dependency; an absolute, escaping, file-URL or network reference fails closed unless it is explicitly external. Planned matched paths may be absent during Preflight/Compile, but Final Gate requires them in the current candidate and materialization alone keeps Authority identity stable. A Web/process proxy cannot satisfy an independently required Native/desktop target. Current machine target-runtime proof exists only when Harness directly spawns that Source-backed process product root; browser/native/desktop/device requirements remain target-blocking External Confirmations. Every `critical_user_path` Outcome and Stage gate accounts for every required target through admitted root proof or that External Confirmation.
+The Contract declares one bounded target profile, its non-empty required product target refs and each target's runtime family, root entrypoint, complete root argv and explicit capabilities. Each required target maps through Source Claim disposition to one canonical Source technical obligation with the same target identity; the process root and every argv path actually admitted by the finite exact/pattern match additionally belong to the production owner and a production Binding. Compile derives one declaration-stable runtime closure from the root, matched argv paths and required carriers rather than copying or broadly scanning all `input_paths` or manifest siblings. It classifies exact child-visible tokens through the closed independent-token/`--name=value` grammar, keeps raw argv separate from cwd-resolved repository locators and never performs shell-like quote or separator rewriting. A safe unmatched relative argument or one of the exact lowercase decimal `node:<number>` and digits-only `<hours>:<minutes>` colon scalars is not a dependency; an unsafe, ambiguous or unsupported reference fails closed unless it is explicitly external. Planned matched paths may be absent during Preflight/Compile, but Final Gate requires them in the current candidate and materialization alone keeps Authority identity stable. A Web/process proxy cannot satisfy an independently required Native/desktop target. Current machine target-runtime proof exists only when Harness directly spawns that Source-backed process product root; browser/native/desktop/device requirements remain target-blocking External Confirmations. Every `critical_user_path` Outcome and Stage gate accounts for every required target through admitted root proof or that External Confirmation.
 
 When a declared result can pass on a proxy surface while failing in its target runtime, the earliest owning Outcome carries either an admitted direct-process root Check or a blocking External Confirmation. A project payload, tracked report, screenshot, binary, log, historical run, new session id or proxy cannot be runtime authority. Checks still declare keyed Given/When scenarios and exact applicability; every Claim-bearing Assertion remains independently attributable without sampling. Project capability records are diagnostic compatibility data; only currently admitted exact/presence and host `target_runtime` results can satisfy their matching all-of cells, while every unsupported capability remains external. Static structure cannot prove behavior. Every behavioral machine Assertion uses a same-Check Counterfactual whose admitted affected Facts change, preserved Facts/liveness do not, other changes are explicit fan-out and baseline/mutated obligation universes and compiled process-closure identities are equal. A Binding or path is not reachability proof: static mutation proves only that structure, while runtime reachability requires Harness mutation of a compiled production carrier → direct Source-backed product-root execution → package-observed Actual change. Pure Authority/verification/evidence/status/report/Receipt/verifier input cannot enter that closure. The remaining runner identity, minimal invalidation-envelope, targeted-feedback and current Final-Gate rules are unchanged; this adds no generic reachability scanner, implementation gate, scheduler or state.
 
-Long-Task Anti-Degradation Assurance protects current causal-chain truth, cross-version interception strength and the adjacent `F = Implementation Freedom Boundary`. Context statements about the current implementation must match the indexed code/runtime; that implementation must still realize the meaning-capture/architecture and fail-closed observation/repair/final-snapshot responsibilities which, under the explicit Source/semantic/TCB boundary, imply the controlling no-false-completion purpose. `F` is an efficiency/anti-process-bloat invariant rather than a third responsibility or theorem premise: inside Source/Contract, architecture, safety, forbidden-shortcut and irreversible/external-action boundaries, implementation order, methods, local feedback cadence and optional one-agent or multi-agent/subagent execution remain Goal-owned. Harness adds no development phase/method Gate, per-edit mandate, agent scheduler/state or delegation proof. Weakening the purpose, key logic, either responsibility, theorem boundary or `F` requires an explicit project-owner design-purpose decision and replacement proof, not Agent inference, coordinated prose/code/test edits or cost alone. A new development-stage constraint must additionally close a distinct path that final proof or a lighter project-owned check cannot cover and demonstrate positive net ROI—specifically evidenced high total-cost ROI and high efficiency—after the hard safety/proof constraints. High means a significant stable margin, not a global/local optimum. Once validity, relative non-degradation, must-allow behavior, structural-cost limits and applicable measured total-cost thresholds close, construction stops unless a new real counterexample, repeated material cost hot spot or evidence of significant additional net benefit appears. This assurance uses existing Context, indexes, tests, critical sentinels, routing and parity gates; it adds no second Authority, Gate or state and cannot recover omitted/unobservable requirements or make itself immutable against deliberate fully authorized joint weakening.
+Long-Task Anti-Degradation Assurance protects current causal-chain truth, cross-version interception strength and the adjacent `F = Implementation Freedom Boundary`. Context statements about the current implementation must match the indexed code/runtime; that implementation must still realize the meaning-capture/architecture and fail-closed observation/repair/final-snapshot responsibilities which, under the explicit Source/semantic/TCB boundary, imply the controlling no-false-completion purpose. `F` is an efficiency/anti-process-bloat invariant rather than a third responsibility or theorem premise: inside Source/Contract, architecture, safety, forbidden-shortcut and irreversible/external-action boundaries, implementation order, methods, local feedback cadence, concrete packet decomposition and dynamic worker count remain Goal-owned. The current positive-default rule requires multiple exact workers only for the bounded qualifying predicate above and otherwise requires one admitted solo reason; Harness adds no development phase/method Gate, per-edit mandate, fixed allocation, agent scheduler/state or delegation proof. Weakening the purpose, key logic, either responsibility, theorem boundary or `F` requires an explicit project-owner design-purpose decision and replacement proof, not Agent inference, coordinated prose/code/test edits or cost alone. A new development-stage constraint must additionally close a distinct path that final proof or a lighter project-owned check cannot cover and demonstrate positive net ROI—specifically evidenced high total-cost ROI and high efficiency—after the hard safety/proof constraints. High means a significant stable margin, not a global/local optimum. Once validity, relative non-degradation, must-allow behavior, structural-cost limits and applicable measured total-cost thresholds close, construction stops unless a new real counterexample, repeated material cost hot spot or evidence of significant additional net benefit appears. This assurance uses existing Context, indexes, tests, critical sentinels, routing and parity gates; it adds no second Authority, Gate or state and cannot recover omitted/unobservable requirements or make itself immutable against deliberate fully authorized joint weakening.
+
+Mechanism and release wording therefore has four evidence levels: designed, implemented, protected against the declared known counterexamples, and high-quality realization within an explicit TCB. The current observer revision remains Level 3. R9/R10 preserve three non-interchangeable proof layers: unused non-closure evidence/verification inputs are must-allow; an attempted product read of a non-closure file is denied by runtime isolation and cannot be accepted; and an explicitly production-bound argv closure member with an evidence/verification role is Compile-rejected. The later raw-argv classification incident is proved by its owner regression, the complete current-candidate lifecycle matrix and independent audit; the historical real-process ROI workload does not prove it and gains no new `CASE_ID`. Compile owner diagnostics bind a complete committed attack candidate, while stale-Authority non-reuse is proved separately by a legal-neighbor Authority followed by Final-Gate freshness rejection on that same attack candidate; `active_task_missing`, a dirty candidate or a fresh Compile rejection cannot substitute. The current machine report owns the exact attack/control population and terminals without a second registry. Level 4 still requires the unchanged complete total-cost ROI theorem, an independent capability audit with no open critical false-acceptance path and separate explicit project-owner approval. Prose review, test counts, fresh-Agent pairs, observed lifecycle wins and sanitized fixtures cannot promote the level or prove real-incident representativeness.
+
+The real-process ROI owner is `examples/delivery-benchmark/real-process-workload/**` plus the real-process runner/policy/scoring, unique package materializer, formal acquisition modules and `tools/verify_long_task_real_process_roi.mjs`. It freezes eight Facts, normal/degraded modes, two Counterfactuals, independent semantic gold, A/B/C roles and each fixture's committed candidate identity. Real-process v5 always collects all five A/B/C repeat orders; the initial-three result remains diagnostic. The materializer alone performs detached checkout, `npm ci`, build, source-parity check and script-disabled pack and binds exact commit/tree/lockfile/runtime/clean status. Workload, collection, summary, aggregate and attestation own only immutable raw or recomputable `observed_lifecycle_*` facts and `formal_status = not_evaluated`. The formal-v2 packet declares one-to-one paths only. After validating the actual manifest-v2 run set, the top verifier constructs an immutable artifact index and alone derives evidence admission, normalized exclusive ownership, `total_roi_supported`, `total_roi_positive` and formal status. Packet-authored bytes, digests, roles, `verified`, normalized values, monetary incident totals, event IDs or conclusions are rejected. The verifier binds exact A/B/C commit/tree/materialized-package, benchmark implementation, acquisition runtime/TCB, scenario, collector, precollection, retention and redaction identities. The delivery-specific accounting remains 1 NCU=CNY 1, CNY 200/50 hourly active/wait proxies, a ten-delivery cycle, five-pair median projection for repeatable costs, once-per-cycle maintenance/recovery, once-only introduction/adoption/migration, and one controlled-incident benefit median. Provider/compute/storage conversion comes only from prelocked actual invoice or official-price material and incident benefit from raw time/usage. Benefit must be at least 1.25 times positive incremental cost, at least 4/5 paired nets must be positive and their sample CV at most 20%; reductions remain separate. Missing evidence keeps support false. Provider-event v1-v2, the other listed formal v1 schemas, real-process v1-v4 and manifest v1 are recollection-required legacy. Machine measurement, independent audit and explicit project-owner promotion remain separate.
+
+The exact current schema matrix is accounting-policy, evidence-packet, precollection-plan, raw-event, scenario-catalog and source-manifest v2; Provider event v3; real-process v5; and run-set manifest v2. Provider-event v1-v2, the other listed formal v1 schemas, real-process v1-v4 and manifest v1 require recollection; `next` is unassigned.
+
+Formal collection additionally prelocks one fixed scenario catalog with exact task/gold bytes for every ten-cost scenario and the one controlled incident. That catalog is the sole scenario/source/zero-policy owner; collectors declare capabilities only and all sources are exactly `required` or `forbidden`. Every execution requires a positive runner-owned contemporaneous active/wait trace. Authoring additionally requires a runner-captured prompt and Provider-issued invocation/request correlation with positive input/output and explicit nonnegative cached-input usage; Runtime, Recovery and test require positive complete-process-tree CPU; State requires a runner-owned exact payload/ledger and prefrozen retention basis. Every event binds a unique raw output: both cost variants must match their common gold, while incident B must differ and C must match it.
+
+One module-private-branded acquisition runtime constructs the interaction recorder, Windows Job Object supervisor, fixed parent Provider bridge, candidate-owned isolated Node Provider worker and State capture itself. The parent captures the exact prompt, creates an invocation-local temporary root and launches the exact worker with `process.execPath`, empty `execArgv`, `shell: false`, bounded pipes and an allowlist-built environment; proxy, custom-CA and Node preload/loader configuration is unsupported and fails closed. One protocol owner freezes request/result shapes, endpoint, prompt/response/stdout/stderr limits, request deadline, abort grace, output-token cap, error codes and environment keys. The worker alone uses `node:https`, bounded streaming and the fixed parser. Its four create-new/no-follow temporary files never enter the run set and must be removed after full worker/bridge closure; disconnect, timeout, overflow, forced termination doubt or cleanup failure blocks the execution. The retained Provider event binds raw-response digest, parser identity and worker identity; the verifier validates that formal acquisition TCB but does not claim to reparse an unretained raw response. The Job path remains unchanged: it creates the child suspended, assigns it before resume, contains descendants, streams bounded stdout/stderr, terminates the whole tree on timeout/overflow, accounts cumulative user+kernel CPU and produces no result until active processes are zero and streams are closed. Output uses a fresh runner root, child-only locator and post-close no-follow read without mtime authority. `invocation_id` is derived before spawn; record SHA and `execution_id` are derived after close. Human, process, wall and Provider clocks have distinct IDs; frozen 250-ms wall/monotonic and 5,000-ms Provider-window tolerances never replace causal correlation.
 
-Mechanism and release wording therefore has four evidence levels: designed, implemented, protected against the declared known counterexamples, and high-quality realization within an explicit TCB. The current observer revision remains Level 3. R9/R10 preserve three non-interchangeable proof layers: unused non-closure evidence/verification inputs are must-allow; an attempted product read of a non-closure file is denied by runtime isolation and cannot be accepted; and an explicitly production-bound argv closure member with an evidence/verification role is Compile-rejected. Compile owner diagnostics bind a complete committed attack candidate, while stale-Authority non-reuse is proved separately by a legal-neighbor Authority followed by Final-Gate freshness rejection on that same attack candidate; `active_task_missing`, a dirty candidate or a fresh Compile rejection cannot substitute. The current machine report owns the exact attack/control population and terminals without a second registry. Level 4 still requires the unchanged complete total-cost ROI theorem and an independent capability audit with no open critical false-acceptance path. Prose review, test counts, fresh-Agent pairs, observed lifecycle wins and sanitized fixtures cannot promote the level or prove real-incident representativeness.
+The catalog derives 86 executions and 586 formal artifacts: 516 base files, 30 compute records, 10 State ledgers plus 10 State payloads, and 10 prompts plus 10 Provider events. Formal capacity is 650 files/364.625 MiB and complete run-set capacity is 4,379 files/974.3125 MiB, including explicit headroom and two excluded self-referential controls; overflow or an unexpected file fails closed. The Evidence Candidate contains all code/schema/Context/test/package-version/protocol bytes. A Promotion Commit must be its direct child and add exactly four package-/TCB-external governance records while mechanically preserving materialized-package, benchmark and runtime/TCB identities; drift requires recollection and reaudit. Runtime TCB v2 binds the clean Node launch, executable path/hash, worker/protocol source identities, parser/transport and all limits. The benchmark implementation identity includes `npm_command_spec.mjs`, the Provider protocol/worker and its owner-local finite dependency checker; working-tree, Git-object, collection and Promotion paths recompute closure and bind the actual executing repository root.
 
-The real-process ROI owner is `examples/delivery-benchmark/real-process-workload/**` plus `tools/long_task_real_process_roi_{policy,runner,scoring}.mjs` and `tools/verify_long_task_real_process_roi.mjs`. It freezes eight Facts, normal/degraded modes, two Counterfactuals, independent semantic gold, A/B/C comparison roles and each fixture's committed candidate identity. Exact raw HEAD/tree/status command records before and after each fixture lifecycle bind that identity and require the candidate to remain clean and unchanged. Its versioned report may expose recomputable `observed_lifecycle_*` validity, paired-win, margin, variance, phase, correct-path, resource and false-completion/false-blocking facts, but those fields have no admission meaning and never use `qualified_positive_*`. Complete total-cost support additionally requires independently attributable verified Authoring, Runtime, State, Recovery, maintenance, test, process, introduction, adoption and migration evidence. The current v2 implementation has no independent formal-cost evidence ingestion and admits no self-attested `verified` row; any missing, unverified or unadmitted category forces `total_roi_supported=false` and forbids `total_roi_positive=true`. Machine measurement and independent governance admission remain separate, and a report-shape change requires a new schema version or an explicit tested compatibility reader that preserves missing evidence.
+Real collection remains `external_pending`: the Starward-derived fixture lacks authorized original incident design/runtime evidence, the complete original-to-sanitized mapping and retention/publication authorization; no retainable invocation-bound Provider usage/price material or State-retention Source has been supplied for this delivery. Synthetic controls prove only structure and may not be presented as formal-positive evidence. The implementation therefore remains Level 3 until qualified real evidence, the sole verifier's complete positive report, independent audit and explicit owner promotion all close. Package 0.8.15 is the historical frozen Evidence Candidate identity; package 0.8.16 is the current Level-3 package candidate and inherits none of its package, benchmark or runtime/TCB evidence. `capability_level` remains `level_3`, `level_4_claimed` remains false, and no formal-positive result or actual Promotion exists. Provider readiness means only that local configuration, credential presence and the clean worker launch envelope permit one bounded attempt. Public `independent_evidence_admitted` means packet structure/source binding only; `total_roi_supported` and `total_roi_positive` remain the complete-evidence and positive-ROI authorities.
 
 The mechanism's own Final-Gate Oracle reads fixed-test-ID machine reports and compares complete wrong-candidate versus correct-control workflow statuses. A runtime capability requires `wrong candidate != machine_accepted` and `correct candidate == machine_accepted` through the real lifecycle; command exit plus token/string presence proves documentation consistency only. ROI is computed by a separate verifier and never enters a safety Fact verdict.
 
@@ -679,7 +691,7 @@ outcomes:
 
 In this example `bin/example-runtime` is the product root, not a verifier wrapper. It emits one stdout JSON object shaped as `{"schema_version":"ty-context-product-observation-v1","observations":{"<compiled-observation-identity>":<actual>}}` with exactly the identities compiled for the shared Raw Execution. Harness supplies no output path, challenge or protocol environment variable; a v3 verifier payload cannot substitute for this product envelope.
 
-Authors provide task, Outcome, control and Check keys. The compiler generates `OUT.<outcome-key>` and `CHECK.<outcome-key>.<check-key>` identities. It rejects unknown/duplicate keys, YAML aliases/tags/merges, dependency cycles, unsafe paths, missing Context/source/runner files, missing package scripts, unverifiable Outcomes, and machine obligations without an admitted observer or blocking External Confirmation.
+Authors provide task, Outcome, control and Check keys. The compiler generates `OUT.<outcome-key>` and `CHECK.<outcome-key>.<check-key>` identities. It rejects unknown/duplicate keys, YAML aliases/tags/merges, dependency cycles, unsafe paths, missing Context/source/runner files, missing package scripts, unverifiable Outcomes, and machine obligations without an admitted observer or blocking External Confirmation. Repository patterns accept parentheses only as escaped literal route-group characters—never regex groups or extglob—while preserving existing `*`, `**`, `?` and rejecting unsupported `[]`/`{}` syntax.
 
 Global non-goals, constraints and forbidden shortcuts generate `GLOBAL.non_goal.<key>`, `GLOBAL.constraint.<key>` and `GLOBAL.forbidden_shortcut.<key>`. They must be covered by Global Check Assertions using local refs. Non-goals and forbidden shortcuts require negative proof; constraints accept either polarity. Outcome and Global Checks cannot cross Claim scope. Global forbidden paths do not generate Claims because the changed-path boundary enforces them statically.
 
@@ -768,7 +780,7 @@ make validate-harness
 
 The modularity gate is `ty-context check-modularity`. Scoped waivers require `owner`, `introduced_at`, `reason`, `tracking_issue` and `expiry_condition`.
 
-`npm run preview:pack` produces a local preview named `project-tiny-context-harness-0.8.13.tgz` under the preview output directory.
+`npm run preview:pack` produces a local preview named `project-tiny-context-harness-0.8.16.tgz` under the preview output directory.
 
 ## Community And Further Reading
 
@@ -792,7 +804,7 @@ For concrete examples, see the [fresh-agent recovery walkthrough](docs/examples/
 - The default Workflow provides model-led, evidence-bounded conformance, not exact declared-scope zero-drift proof or machine completion authority; unverified and externally pending scope must remain explicit.
 - Bounded Context keyword search can still miss synonyms or indirect dependencies; it supplements rather than replaces semantic judgment.
 - Harness cannot switch the host-selected model; it only asks for the one post-Authority-Lock user choice.
-- Tiny Context provides no parallel mutation or delegation runtime. The platform Goal may use its own opaque implementation delegation, but Harness does not persist it or accept it as evidence.
+- Tiny Context provides no parallel mutation or delegation runtime. When the package-managed Skill's bounded predicate holds, the platform Goal must make actual host calls for multiple exact `long_task_implementation` workers; Harness does not allocate or persist that dispatch and never accepts it as evidence.
 - It does not observe platform token counts or model-call counts.
 - Network policy is declared to runners and proxy variables are restricted. The admitted direct-process path also runs a frozen runtime-closure copy and monitors/cleans its process tree, but neither mechanism is an OS security sandbox or a proof against malicious escape into ambient filesystem, network or process resources.
 - Same-user/admin filesystem tampering and Hook bypass are outside its security boundary.